CLOUD-SECURITY-ENGINEER practice question 18 of 35

When working with agents in a support center via online chat, an organization’s customers often share pictures of their documents with personally…

When working with agents in a support center via online chat, an organization’s customers often share pictures of their documents with personally identifiable information (PII). The organization that owns the support center is concerned that the PII is being stored in their databases as part of the regular chat logs they retain for review by internal or external analysts for customer service trend analysis. Which Google Cloud solution should the organization use to help resolve this concern for the customer while still maintaining data utility?

Answer options

A: Use Cloud Key Management Service (KMS) to encrypt the PII data shared by customers before storing it for analysis.

B: Use Object Lifecycle Management to make sure that all chat records with PII in them are discarded and not saved for analysis.

C: Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis. Correct answer

D: Use the generalization and bucketing actions of the DLP API solution to redact PII from the texts before storing them for analysis.

Correct Answer:

C. Use the image inspection and redaction actions of the DLP API to redact PII from the images before storing them for analysis.

Explanation

The core problem is the presence of Personally Identifiable Information (PII) in images that need to be stored for analysis. The Cloud Data Loss Prevention (DLP) API is specifically designed to discover, classify, and protect sensitive data. Its image inspection capabilities can use Optical Character Recognition (OCR) to find text within the images, identify PII, and then apply a redaction transformation to black out the sensitive data. This process removes the PII while preserving the rest of the image and associated chat log, thus maintaining the data's utility for trend analysis without compromising customer privacy.

Why Incorrect

A. Cloud KMS encrypts data but does not remove it. Analysts with decryption permissions could still view the PII, which fails to resolve the concern.
B. Object Lifecycle Management would delete the entire chat record, destroying its value for trend analysis, which contradicts the goal of maintaining data utility.
D. Generalization and bucketing are DLP de-identification techniques for structured or text data, not for redacting specific information from within an image file.

References

1. Google Cloud. (2023). Redacting sensitive data from images. "The Cloud DLP API can inspect text in images for sensitive data and return the locations of the data. It can also return a redacted version of the image with the sensitive data obscured."

2. Google Cloud. (2023). Cloud Data Loss Prevention (DLP) documentation. "De-identification techniques like masking, tokenization, pseudonymization, date shifting, and more help you keep your data useful without exposing user identities." Section: De-identify sensitive data at scale. (This reference helps differentiate C from D).

3. Google Cloud. (2023). Inspecting images for sensitive data. "Cloud DLP uses optical character recognition (OCR) technology powered by Cloud Vision to transcribe text from images. It then uses its full range of detectors to inspect the transcribed text for sensitive data."

Keep practicing

Take the free CLOUD-SECURITY-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test